Add generic plugin architecture and watch-directory feature

Introduces a manifest contract so feature containers self-describe their
settings (JSON Schema + access rules). Backend and frontend gain generic
plugin proxy and dynamic Extensions UI with zero feature-specific code.

Doc-service is the first plugin consumer: exposes /plugin/manifest and
/plugin/settings, adds a watchdog-based file watcher that auto-ingests
PDFs from a mounted directory, maps subfolders to categories, supports
AI-suggested folder/filename (user-confirmed), and enforces a no-remove
policy. Access is gated by is_superuser or doc-service-admin group.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -70,6 +70,7 @@ services:
       AI_SERVICE_URL: http://ai-service:8010
     volumes:
       - doc_data:/data/documents
+      - watch_data:/data/watch
       - app_config:/config
     depends_on:
       db:
@@ -98,6 +99,7 @@ services:
 volumes:
   postgres_data:
   doc_data:      # PDF files persisted across restarts
+  watch_data:    # Watch directory — bind-mount your NAS/Nextcloud here via docker-compose.override.yml
   app_config:    # Per-service runtime config JSON files
 
 networks: